ultra-builder-pro-cli 0.24.1 → 0.25.0

package/CHANGELOG.md

@@ -7,6 +7,69 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.25.0] — 2026-07-31
+
+### Added
+
+- Added `task_outcome / attest_commit` as the sole model-facing path for recording
+  checkout-local integrated commit proof after durable Task completion.
+
+### Changed
+
+- Published exact Task identifier, numeric, array, object, digest, and runtime-field
+  boundaries in the seven-tool MCP contract while keeping repository-defined Task,
+  Change, priority, risk, research, and slice labels under model ownership.
+- Applied the same exact-input boundary to Baseline, Change, Decision, Artifact, Event,
+  Context, Checkpoint, Sync, Session, Archive, and Doctor calls. Unknown fields and
+  wrong scalar, enum, array, object, digest, or scope types are rejected before SQLite
+  affinity or downstream consumers can reinterpret them.
+- Made Dev delivery publish durable completion before one integration commit, then
+  attest that commit locally without changing the Git-facing team ledger.
+
+### Fixed
+
+- Removed arbitrary Task patches and model-supplied commit hashes from
+  `task_outcome / complete`, eliminating the remaining self-referential or
+  bookkeeping-commit path.
+- Fixed malformed semantic input and idempotency attempts escaping as transport or raw
+  SQLite errors. Correctable requests now return mutable diagnostics and enter bounded
+  rejected-attempt audit history without creating semantic authority.
+- Fixed record, checkpoint, team-checkpoint publication, Session lease, Worker Packet,
+  and archive receipt failures leaving database rows, managed files, worktrees, or Git
+  checkpoint bytes partially committed. Each public mutation now commits its durable
+  receipt with the owned state or compensates the external effect before retry.
+- Fixed Task deletion reporting a generic draft-state error before identifying the
+  exact durable Session, Artifact, checkpoint, Context, workflow-history, or recovery
+  reference that must be resolved.
+- Added a linked active successor path for immutable archived or cancelled Changes
+  instead of requiring history mutation or direct SQLite repair.
+- Removed the public Kernel's runtime dependency on the retired workflow supervisor;
+  the legacy Change implementation remains compatibility-only and is absent from all
+  five bundled host runtimes.
+- Revoked an assigned Worker Packet when a parallel reservation is unwound, ensuring
+  the abandoned capability cannot later complete a Task without a live Session.
+
+## [0.24.2] — 2026-07-31
+
+### Changed
+
+- Made the production Change facade single-mode and Kernel-only. The pre-v0.24
+  Change implementation is explicitly isolated for compatibility, while retired
+  workflow and dialogue rows remain read-only history with no public artifact owner
+  or invalidation writer.
+- Made review and debug agents evidence-only: delegated workers can write only their
+  assigned report, while the primary host owns source remediation and final judgment.
+
+### Fixed
+
+- Preserved rejected semantic calls as bounded `ultra_kernel_attempt` audit history
+  visible through `ultra.context`, without creating the rejected semantic authority.
+- Renamed misleading `_ultra.state_commit` response metadata to
+  `_ultra.projection_commit`; projection processing no longer resembles a semantic
+  acceptance receipt.
+- Removed current Change-packet decisions and artifact invalidation from retired
+  workflow/dialogue tables while retaining safe migration and historical reads.
+
 ## [0.24.1] — 2026-07-31
 
 ### Changed

package/README.md

@@ -132,6 +132,11 @@ Retired fine-grained operation names are neither discoverable nor callable. Work
 prose stays in Skills, model judgment stays with the host, and SQLite records what
 happened rather than deciding what the model is allowed to think next.
 
+Rejected semantic attempts remain visible as bounded `ultra_kernel_attempt` audit
+diagnostics in the next `ultra.context`; they do not create rejected authority.
+`_ultra.projection_commit` describes only generated-view processing, never semantic
+acceptance. The production Change API has no legacy/current mode switch.
+
 The enforcement gradient is:
 
 ```text
@@ -404,6 +409,11 @@ recommends the next capability from current context and owner intent; SQLite doe
 encode the semantic route. Another public capability starts only after an explicit
 user command or skill invocation.
 
+Review and debug agents are evidence-only workers. They may inspect the assigned
+checkout and write their declared report, but they never edit source or commit
+authority. The primary host evaluates the evidence, applies any repair, and records
+the verified outcome.
+
 ### Command interaction graph
 
 Every solid handoff below means: the current capability returns context and checkpoint

package/adapters/claude.js

@@ -5,6 +5,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
+const { spawnSync } = require('node:child_process');
 
 const {
   copyTree,
@@ -53,6 +54,77 @@ function resolveRepoRoot(ctx = {}) {
   return ctx.repoRoot || path.resolve(__dirname, '..');
 }
 
+function shouldRunHostCli(ctx = {}) {
+  if (typeof ctx.runHostCli === 'boolean') return ctx.runHostCli;
+  return ctx.scope === 'global' && !ctx.configDir;
+}
+
+function runClaudeCli(args, ctx = {}) {
+  const result = spawnSync(ctx.claudeBin || 'claude', args, {
+    encoding: 'utf8',
+    timeout: ctx.hostCliTimeoutMs || 30000,
+    killSignal: 'SIGKILL',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    env: {
+      ...process.env,
+      CLAUDE_CONFIG_DIR: resolveTarget(ctx),
+    },
+  });
+  if (result.error) {
+    if (result.error.code === 'ETIMEDOUT') {
+      const error = new Error(`claude ${args.join(' ')} timed out`);
+      error.code = 'HOST_CLI_TIMEOUT';
+      throw error;
+    }
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout || '').trim();
+    throw new Error(`claude ${args.join(' ')} failed${detail ? `: ${detail}` : ''}`);
+  }
+  return result.stdout;
+}
+
+function claudeMcpRow(output, identity) {
+  for (const rawLine of output.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.slice(0, identity.length) !== identity) continue;
+    if (line[identity.length] !== ':') continue;
+    return line;
+  }
+  return '';
+}
+
+function inspectClaudeHost(ctx = {}) {
+  const target = resolvePluginRoot(ctx);
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(target, '.claude-plugin', 'plugin.json'), 'utf8'),
+  );
+  const plugins = JSON.parse(runClaudeCli(['plugin', 'list', '--json'], ctx));
+  if (!Array.isArray(plugins)) throw new Error('claude plugin list --json did not return an array');
+  const plugin = plugins.find((entry) => entry?.id === `${PLUGIN_NAME}@skills-dir`);
+  const pluginOk = !!plugin
+    && plugin.enabled === true
+    && plugin.version === manifest.version
+    && path.resolve(plugin.installPath || '') === path.resolve(target);
+  const mcpOutput = pluginOk
+    ? runClaudeCli(['mcp', 'list'], ctx).replace(/\u001b\[[0-9;]*m/g, '')
+    : '';
+  const mcpLine = claudeMcpRow(
+    mcpOutput,
+    `plugin:${PLUGIN_NAME}:${MCP_SERVER_NAME}`,
+  );
+  const mcpOk = pluginOk
+    && !!plugin.mcpServers?.[MCP_SERVER_NAME]
+    && /\bConnected\b/i.test(mcpLine);
+  let detailsOk = false;
+  if (pluginOk) {
+    runClaudeCli(['plugin', 'details', `${PLUGIN_NAME}@skills-dir`], ctx);
+    detailsOk = true;
+  }
+  return { plugin, pluginOk, mcpOk, mcpOutput, detailsOk };
+}
+
 function copySkills(repoRoot, target, names) {
   const copied = [];
   for (const name of names) {
@@ -245,6 +317,37 @@ function doctor(ctx = {}) {
     expectedAdapter: 'claude',
     expectedPackageVersion: source.packageInfo.version,
   });
+  if (shouldRunHostCli(ctx)) {
+    try {
+      const host = inspectClaudeHost(ctx);
+      report.checks.host_plugin = {
+        status: host.pluginOk && host.detailsOk ? 'pass' : 'fail',
+      };
+      report.checks.host_mcp = { status: host.mcpOk ? 'pass' : 'fail' };
+      if (!host.pluginOk || !host.detailsOk) {
+        report.issues.push({
+          code: 'HOST_PLUGIN_NOT_DISCOVERED',
+          plugin_id: `${PLUGIN_NAME}@skills-dir`,
+        });
+      }
+      if (!host.mcpOk) {
+        report.issues.push({
+          code: 'HOST_MCP_NOT_DISCOVERED',
+          plugin_id: `${PLUGIN_NAME}@skills-dir`,
+          server: MCP_SERVER_NAME,
+        });
+      }
+    } catch (error) {
+      report.checks.host_plugin = { status: 'fail' };
+      report.checks.host_mcp = { status: 'fail' };
+      report.issues.push({
+        code: error.code === 'HOST_CLI_TIMEOUT'
+          ? 'HOST_CLI_TIMEOUT'
+          : 'HOST_CLI_INSPECTION_FAILED',
+        message: error.message,
+      });
+    }
+  }
   return applyNativeDoctor(report, path.join(resolvePluginRoot(ctx), 'runtime'));
 }
 
@@ -265,6 +368,7 @@ module.exports = {
   SOURCE_TAG,
   MCP_SERVER_NAME,
   buildHooksManifest,
+  inspectClaudeHost,
   resolveTarget,
   resolvePluginRoot,
   install,